From 89b5865a4c596cea724b3130e2159808ba2e8ee2 Mon Sep 17 00:00:00 2001 From: Zach Brown Date: Wed, 4 Aug 2021 10:05:11 -0700 Subject: [PATCH] Verify that log tree commit is for sending rid We were trusting the rid in the log trees struct that the client sent. Compare it to our recorded rid on the connection and fail if the client sent the wrong rid. Signed-off-by: Zach Brown --- kmod/src/server.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kmod/src/server.c b/kmod/src/server.c index 510114aa..b5a8539c 100644 --- a/kmod/src/server.c +++ b/kmod/src/server.c @@ -882,6 +882,7 @@ static int server_commit_log_trees(struct super_block *sb, u8 cmd, u64 id, void *arg, u16 arg_len) { struct scoutfs_super_block *super = &SCOUTFS_SB(sb)->super; + const u64 rid = scoutfs_net_client_rid(conn); DECLARE_SERVER_INFO(sb, server); SCOUTFS_BTREE_ITEM_REF(iref); struct scoutfs_log_trees lt; @@ -896,6 +897,11 @@ static int server_commit_log_trees(struct super_block *sb, /* don't modify the caller's log_trees */ memcpy(<, arg, sizeof(struct scoutfs_log_trees)); + if (le64_to_cpu(lt.rid) != rid) { + ret = -EIO; + goto out; + } + scoutfs_server_hold_commit(sb); mutex_lock(&server->logs_mutex);